Install or remove the CSF firewall on a cPanel server

On a cPanel server, install CSF with dnf install cpanel-csf (AlmaLinux, CloudLinux) or apt install cpanel-csf (Ubuntu), then turn off testing mode in WHM.

Before you install

CSF (ConfigServer Security & Firewall) manages the server's firewall, and its LFD service blocks IP addresses after repeated failed logins. It doesn't work together with firewalld. Check whether firewalld is installed:

systemctl status firewalld --no-pager

If it is, stop it and remove it (AlmaLinux and CloudLinux):

systemctl disable --now firewalld
dnf remove firewalld

On Ubuntu, switch off UFW instead: systemctl disable --now ufw.

Install CSF

Connect as root (see Connect to your server with SSH) and install the package.

AlmaLinux or CloudLinux:

dnf install cpanel-csf

Ubuntu:

apt install cpanel-csf

Check that it's installed:

csf -v

This prints the CSF version. You may see a few lines like unlink: cannot unlink '/etc/csf/uninstall.sh' during the installation: cPanel lists them as harmless.

Turn off testing mode

A new CSF installation runs in testing mode, which clears the firewall again after a few minutes. Turn it off once you've checked you can still reach the server:

1. In WHM, go to Plugins » ConfigServer Security & Firewall.

2. Click Firewall Configuration.

3. In Initial Settings, set TESTING to Off.

4. Scroll down and click Change, then Restart csf+lfd.

The installer opens the ports cPanel needs, but check them in the same Firewall Configuration page (TCP_IN and TCP_OUT). If SSH on your server uses a port other than 22, make sure that port is in TCP_IN before you leave testing mode.

Check from SSH that CSF and LFD are running:

csf -l | head -n 20
systemctl status lfd --no-pager

The first command lists the active firewall rules. LFD should show active (running).

Allow your own IP address

Add the IP address you work from, so LFD never blocks you after a few wrong passwords:

csf -a 203.0.113.25 "my office"

In WHM you can do the same with Quick Allow on the CSF page.

Useful CSF commands

Move an old CSF installation to cPanel's version

If your server still runs CSF installed from configserver.com, check its version:

cat /etc/csf/version.txt

Servers with version 14.00 to 15.00 and automatic updates switched on were moved to cPanel's update source from 25 February 2026, with their rules and settings unchanged. For any other old installation, run the install command above: the package takes over your existing CSF.

Remove CSF

cPanel's version (cpanel-csf), on AlmaLinux or CloudLinux:

dnf remove cpanel-csf

On Ubuntu, apt remove cpanel-csf keeps the settings in /etc/csf/ and /usr/local/csf/; apt purge cpanel-csf deletes them too. On AlmaLinux and CloudLinux, delete those two folders yourself if you don't want to keep the settings.

An old installation from configserver.com came with its own removal script:

sh /etc/csf/uninstall.sh

Check that CSF is gone: csf -v should now report "command not found", and the plugin should no longer appear in WHM under Plugins.

Put a firewall back after removing CSF

Without CSF the server has no firewall at all. cPanel's documented way back is the system firewall plus cPanel's own setup script:

dnf install firewalld
systemctl enable --now firewalld
/usr/local/cpanel/scripts/configure_firewall_for_cpanel
firewall-cmd --list-all

The script opens the ports cPanel & WHM uses, and the last command shows them. On Ubuntu, install UFW with apt install ufw instead of the first two lines, run the script, and check with ufw status.

Common problems

You locked yourself out

Log in through a console that doesn't depend on SSH, such as a VNC or rescue console, or open a ticket if you can't. Then remove the block with csf -dr your-ip, or stop the firewall with csf -x while you fix the settings.

Firewall rules aren't loaded after a CSF update

cPanel lists this as a known issue with some package upgrades. Reload the rules with csf -ra.

The CSF plugin still shows in WHM after removal

Older cpanel-csf versions left the plugin and the LFD status entry behind. Install the current package again with dnf install cpanel-csf, then remove it: newer versions clean up properly.

Related articles

• Install cPanel & WHM on AlmaLinux
• Update cPanel & WHM from the command line
• Connect to your server with SSH

Still stuck? Open a support ticket and we'll help.